Standardizing Stealth Addresses

Transcript

[Music] foreign [Music] perfect thank you everyone thank you everyone for coming my name is Tony I'm with the F and also with the Vienna University of economics and business and today I'd like to present the topic and you'll see that I'm very passionate about so the today's talk will be about blockchain privacy and in specific we are going to talk about

stealth addresses so just for those who don't know me so I've done some hobbish projects like math booster pigs and 1080warning.info and also doing research at EF but today's talk is actually a little different so today I want to present the near C your c5564 to you which is stealth addresses so just to give you a rough outline what I'm going to talk about the first part will Define the problem so we will talk about which problem do we try to solve with stealth addresses then I'd like to quickly introduce you how staff addresses work which is um yeah a little math but it's I try to keep it very simple and short and last

but not least I try to cover some use cases and also mention how we why we need an ERC for stealth addresses and what's the what's the purpose of standardizing them so let's directly jump into the problem definition so what you can see here is we have two entities we have a and b Alice and pop and Alice has some money that she wants to transfer to Bob so far so simple the problem is they're using a public blockchain and as we know everything is public so everyone can see their interaction between Alice and Bob of course Alice cares a lot about privacy and she doesn't want to let

everyone in the world know that she has some connection with Bob so every Alice tries to avoid the link between her and Bob so what she could do is very simple she could just reach out to Bob and say hey Bob I don't want to transfer the funds to your publicly known address that is already doxed please generate a new address and I will use that for our transfer pop would probably be like yeah sure let's do that and in the end what they achieve is like Alice can just send the funds to the new address that Bob just generated which is in this case address C and what they what they got is they didn't create a link between A and B so they create a link between a and C so the world would

still see that Alice sent some funds but they would not know that it's Bob the problem here is at some point pop would be like okay that was quite smooth but wouldn't it be even smoother if we could do that without having any prior interaction and this is exactly the point where both of them might at some point discover stealth addresses so what stealth addresses allow Alice to do is to generate an address in the name of Bob knowing that only Bob will be able to generate the private key to that address so without any prior interaction Alice can generate an address for Bob send funds to that address and know knowing that only Bob can access those funds in the end so there's no interaction in

between them and for everyone else it would simply look like if Alice just sent the funds to some random address in the end what they achieve by doing that is unlinkability so there are two properties or maybe three properties but we will focus on two which is untraceability and unlinkability so untraceability always requires some mixing some mixing like we know from the NATO cache or from coin joints on bitcoin and stuff addresses will only provide you unlinkability so what you get is you cannot link the sender to the recipient but there's no mixing involved so in the end there is no connection between Alice and Bob but only between Alice and some

new address some never used address and this could even be Alice herself right maybe Alice just set up a new wallet and transferred the funds to a new address so that's more or less the concept behind staff addresses and now I'd like to quickly show you how that works let's walk you through an example so what you can see here is again Alice and Bob and both of them have access to an key pair so the lowercase letters are the private keys and their uppercase letters are the public keys so Bob has access to his known keeper which is doxed so it's probably bob.e or something and Alice has an ephemeral keeper this is important so LS keeper is just randomly generated and is not her

real keeper so Bob uses his own keeper and Alice just randomly generates a new key pair so the first step is for LS to generate a stealth address for Bob would be to get Bob's public key so the public key is by nature public so Alice can just take pop Bob's public key and then she does The Following so the first step is LS generates a shared secret here denoted as the lowercase letter s so Alice takes her own ephemeral private key just recall it was randomly generated so Alice takes the private key and multiplies it with the public key of Bob to generate the shared secret then she hashes the shared

secret and from that hash she derives again in a loop elliptic curve Point she does so by multiplying the hash C shared secret which you can see in the third row she multiplies the hash chat secret with the generator point of the elliptic curve and then she adds Bob's public key again to it so what she gets when she multiplies the hashtag secret to the generator point is an elliptic curve point and then she can just do an elliptic curve addition and adds Bob's public key to it and finally the outcome would be a stealth public key and she can just use the normal way a traditional way to turn public Keys into ethereum addresses so she can just

use that stealth publicity to generate the stealth address so at this point Alice has generated a stealth address for Bob without any interaction with Bob yet the next step for us would be to send the funds to the stealth address so Alice sends the funds to the staff address and in the same transaction Alice publishes her ephemeral public um yeah the terminal public key so the environmental public key is just the public key that was generated from the randomly generated private key so Alice puts the ephemeral public key on chain and at this point Bob can essentially start with finding his own stealth address so what Bob would do is he would

engage in some parsing so Bob would need to go through all the ephemeral public keys that had ever been published and look over all these public keys and check maybe one of these public keys can be used to find his own stealth address and this works like the following so Bob has then a list of all the ephemeral public keys that have ever been published which is he donated as ABC the uppercase letters and Bob would then Loop over all these ephemeral public keys and tries the following so he tries to multiply all of them with his private key then hashes the result essentially it does the same as Alice did and multiplies It Again by the

generator point and adds his own public key to it and at this point if the transaction was really supposed to go to Bob so if Alice used Bob's public key um together with the ephemeral private key then Bob will be able to find his own Staff address and this is essentially possible because more or less if you change if you calculate the shared secret here and the shared secret here with the right ephemeral public key then they will both arrive at the same shared Secret so in the end pop derives the same stealth address as LS and if he finds a Staff address that has funds on it he knows he will be able to access that

address and spend those funds and now the coolest thing here is the last line on the right side because how would Bob then access the funds Bob would be able to access the funds by taking his own private key and adding it to the hash chat secret so this is a normal normal Edition and Bob would just add his own private key to the hashtag secret and the outcome would be the private key that can finally access the stealth address that's essentially how staff addresses work and this equation for those very interested in it so this is the equation that makes everything possible so what what this equation says is we have the

hashtag secret we can take it times the generate the point of the elliptic curve and add the public key which is essentially the same as first adding the two integers which are Bob's private key on the right side and the hashtag secret and then add multiplying that by the generator point and because this equation holds true the whole thing will work then of course this is not very handy as of now because Bob needs to do some parsing and the parsing can be um yeah it can be very hard especially when there are many many ephemeral

public Keys involved so what we do now is we split up the keeper that Bob owns into two key pairs so Bob previously had one keeper his private um consisting of his private key and his public key and now Bob has two keepers which is a spending and the scanning key and the cool thing here is now Bob can now Outsource the parsing the parsing is always not something that we want to let users do but now Bob can just give out his spending uh his scanning private key and Outsource the parsing process which means Bob can give for example the private key so the scanning private key

to some party to some exchange and this exchange could then find the stealth addresses for Bob but would not be able to spend from that Staff address this is very important so what we get by equipping Bob with two keepers is the feature that Bob can give away his scanning private key while still remaining full control of his actual funds on the stealth address this some of you might be reminded from the crypto node white paper from 13 which proposed essentially that for staff addresses so just equipping the recipient with two keepers allows us to Outsource the parsing

right so that was enough elliptic curve math for now let me quickly tell you why we need some standardization so why there's even some an ERC required for stealth addresses the problem with staff addresses is that not every stealth address protocol is equal to another Staff address protocol so you can use many different ways to generate staff addresses you can use the SEC 250 256 K1 curve the R1 curve there are stealth address protocols being proposed using elliptic curve pairings and then even more sophisticated ways you can even use lattice based cryptography to generate stealth addresses and because the recipient needs to know how the how

the sender generated the Staff address we need some standardization because otherwise the recipient would not know which exact Staff address protocol was used by the sender so maybe the sender used SEC 256 K1 maybe the sender used staffordshire's protocol based on elliptic curve pairings and the recipient would more or less have to go through every possible protocol to find his stat address just to give you a rough sense of how many stealth address protocols there were supposed this was just a selection of some papers I found very interesting and there you find stuff address protocols being proposed using the standard sector 256 K1 curve there was definitely just protocols based on

lattice based cryptography but also elliptic curve pairings so Academia found many different ways many improvements for self-adjust protocols and hasn't stopped so at some point when we want to implement staff addresses we need some standard way to let the recipient know how the Staff address was generated on the sender side because just to recall there is no interaction so what ERC 5564 is now proposing is a common basement for more or less that allows different stealth address protocols to be built on top of the foundation so ERC 5564 proposes a simple smart contract that is then used to

announce to broadcast the ephemeral public key which is essentially the information that the recipient needs to find his staff address and to finally access the Staff address and in the end standardization is key in the sense because otherwise the recipient would never know which exact staff are just protocol that was used for those knowing solidity you can see the contract here on the left hand side it's essentially a very simple smart contract that only consists of an event and a function and the function lets you do nothing else than emitting the event so we have the function that can then be called by everyone to during the stealth address transfer and letting the

recipient know exactly which stealth address protocol that was used and we do so by using a shim ID so in the shim ID we specify which exact protocol that was used for example number one could be the SEC 256 K1 curve she made number two could be some lattice based cryptography stealth address protocol then there are some additional parameters in that event you can see we have the stealth address itself in the event this is very handy to not force the recipient to do any additional RPC calls then there is the caller in the event which is just used to have some anti-dos attack

filtering enabled because of course you load some computations over to the recipient side which are not priced in with gas right so we we are open for those attacks but they can easily be filtered on the recipient side and that's why we include the caller then there is the ephemeral public key that's essentially the very important information required on the recipient side to find the stealth address and then also to derive the private key to the stealth address and then some metadata which is just very handy to allow the recipients directly to get some additional information um for which token was transferred or if

there was a special method like an approval executed ERC 5564 also comes with its own address stream which consists more or less of two public keys in compassed form so as I said the recipient has two public keys so we use these two public Keys we just concatenate them and then we put them into one address format to allow senders a more a simpler way a simpler way to send to a stealth address there would also be another ESC a follow-up one which just proposes a registry where users can register their staff addresses and then it may make it more easy for the recipient for senders

to find the stealth Med address which is the one to generate that the staff addresses from for the recipient finally very quickly what staff addresses can be used for staff addresses are very handy to be used for donations sometimes you want to secure the the person you're donating to because maybe you don't want to create a connection to the person you're donating to or vice versa maybe the person receiving the donation doesn't want to have a connection to the person to the person's donating to this one payroll tax private messaging and so on so there are many different use cases where staff addresses can be very handy finally find some additional information on the links provided here on the slide

so there is a proof of concept implemented on stealth hyphen wallet.xyzat you can find the ercs in the EAP repo and also um you can write there's also a paper so we wrote an academic paper which is called base sap so the base for stealth address protocols you can find the academic paper which also describes all the stuff I just told you very very detailed and also feel free to reach out to me if you have any additional questions or especially if you building a wallet or something and you want to implement staff addresses in your wallet I'm very happy to help you thank you very much

[Applause] sorry we don't have time so feel free to have the question outside of them yeah just reach out to me if you have any questions [Music] foreign